Senior Governance, Risk and Compliance Engineer

This is a fully remote position, open to applicants in Portugal, +2 more countries.

📋 Description

• Develop, maintain, and enhance information security policies, standards, and procedures in alignment with ISO 27001 and relevant regulatory requirements.

• Oversee the entire policy lifecycle, which includes approval processes, regular reviews, ownership assignments, and version control.

• Manage the information security risk register, focusing on risk identification, assessment, treatment tracking, and formal acceptance of risks.

• Prepare risk reports for management and governance committees and monitor remediation actions until closure.

• Assist with compliance initiatives under DORA, including the Register of Information, PSD2/EBA ICT guidelines, GDPR, and PCI DSS across licensed entities.

• Contribute to operational resilience efforts for the UK entity in accordance with FCA requirements.

• Oversee the third-party risk management lifecycle, which includes due diligence, security questionnaires, risk ratings, onboarding checkpoints, and periodic reassessments.

• Maintain the vendor register and collaborate with the Legal team on contractual security requirements.

• Coordinate both internal and external audits, including Big Four ICT audits, regulator requests, and PCI QSA cycles, while managing the audit calendar.

• Responsible for evidence collection and upkeep of an evidence library for audits, certifications, and client questionnaires.

• Administer and enhance the GRC platform, focusing on control monitoring, automated evidence collection, framework mapping, and reporting.

• Utilize AI tools in GRC activities such as policy drafting, gap analysis, evidence assembly, and questionnaire responses, while automating recurring processes.

• Participate in the AI governance program, which includes AI vendor assessments, support for the AI system register, and alignment with emerging requirements like the EU AI Act.

• Report directly to the Head of Information Security.

⛳️ Requirements

• Minimum of 3 years of relevant experience in GRC, information security governance, IT audit, or IT risk management.

• Proficient understanding of ISO/IEC 27001.

• Familiarity with DORA, GDPR, or PCI DSS.

• Experience within regulated financial services (payments, e-money, banking, fintech) or advisory roles for such firms.

• Practical experience with audits, including coordinating audits, preparing evidence, and addressing findings.

• Knowledge of GRC platforms or a keen interest in compliance automation.

• Strong proficiency in written English.

• Capability to manage multiple workstreams under fixed deadlines.

• Certifications such as CISA, CRISC, CISM, CIPP/E, or ISO 27001 Lead Auditor / Lead Implementer are advantageous.

• Direct experience with DORA implementation, EBA outsourcing guidelines, or FCA operational resilience would be beneficial.

• Experience in implementing or administering GRC platforms like Vanta, ServiceNow GRC, OneTrust, or similar is a plus.

• Familiarity with ISO 42001, the EU AI Act, or AI risk management is an advantage.

• Basic scripting or workflow automation skills using low-code tools would be beneficial.

🏝️ Benefits

• Annual Learning Budget available for professional development (eligible after probation).

• Company celebrations that bring together colleagues from all offices.

• Opportunities to engage in international company events and initiatives.

• Global collaboration with colleagues from diverse regions.